PT-2015-1894 · Cisco · Cisco Asa

Published 2015-08-12 · Updated 2023-08-11 · CVE-2015-4321

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.3(1.50) through 9.3(3) Cisco Adaptive Security Appliance (ASA) Software version 9.4(1)

Description The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table. This allows remote attackers to bypass uRPF validation via spoofed packets. The vulnerability exists due to insufficient input validation, which can be exploited by sending specially crafted IP packets to bypass the uRPF mechanism designed to protect against IP address spoofing.

Recommendations For version 9.3(1.50), update to a fixed version to resolve the issue. For version 9.3(2.100), update to a fixed version to resolve the issue. For version 9.3(3), update to a fixed version to resolve the issue. For version 9.4(1), update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the uRPF feature until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-11240

CVE-2015-4321

Affected Products

Cisco Asa

References · 5

• https://bdu.fstec.ru/vul/2015-11240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4321 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40440 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150812-CVE-2015-4321 · Vendor Advisory
• http://securitytracker.com/id/1033265 · Note